Data and role mapping
Identify processing activities, data subjects, purposes, systems, recipients, transfers and controller–processor roles.
Data-protection compliance is an operating system: it connects purposes, legal bases, notices, consent, vendors, access, security, retention and individual rights. Registration is important, but it is not a substitute for accountable processing.
Discuss your routeWho this is for
Built around the proposed activity.
- Fintechs, employers, digital platforms and regulated institutions
- Businesses acting as controllers, processors or both
- Organisations using biometrics, profiling, sensitive data or innovative technology
- Businesses responding to complaints, incidents, audits or enforcement correspondence
Typical work sequence
From legal perimeter to operating evidence.
Registration and risk
Assess registration obligations, sensitive and high-risk processing, DPIA triggers and cross-border transfer safeguards.
Governance and contracts
Develop notices, policies, retention rules, rights procedures, data agreements, incident response and accountability records.
Remediation and response
Support complaints, breach assessment, regulatory correspondence, corrective action and continuing privacy review.
Core readiness areas
What the work normally needs.
- Accurate controller and processor role assessment
- Inventory of processing activities, systems, vendors and data flows
- Appropriate legal bases, notices and consent mechanisms
- Registration, DPIA and cross-border transfer assessments where applicable
- Processor, data-sharing and technology contracts
- Security, retention, rights-handling, incident and accountability controls
Common pressure points
Problems to resolve before they become delays.
- 01
Registering without mapping whether the organisation is a controller, processor or both
- 02
Using generic privacy notices that do not match actual purposes, recipients, retention or transfers
- 03
Signing vendor contracts without adequate processor, security, breach and subprocessor provisions
- 04
Conducting a DPIA after the product, procurement and system design are already fixed
How the firm assists
A defined mandate, not a generic package.
We support ODPC registration, privacy audits, notices and policies, DPIA screening and preparation, data-processing and sharing agreements, cross-border assessments, incident response, complaint handling and regulatory remediation.
Send a non-confidential enquiryFrequently asked questions
Useful starting answers.
Is ODPC registration the same as full compliance?+
No. Registration addresses the statutory register; lawful, fair, secure and accountable processing requires wider operational controls.
When is a DPIA required?+
A DPIA is required before processing likely to result in high risk to individuals’ rights and freedoms. The Act, Regulations and ODPC guidance should be applied to the proposed processing before implementation.
Can a processor rely only on the customer’s privacy policy?+
No. A processor has its own statutory and contractual responsibilities and should have appropriate processing, security, subprocessor, incident and assistance arrangements.
info@snnyagaadvocates.co.ke+254 728 852 448Westpark Towers, 11th Floor, Mpesi Lane, Westlands, Nairobi